Danilo Dy Mon, 07/07/2008 - 03:36
User Badges:
  • Blue, 1500 points or more

Basic security..

- when installing OS, install only the necessary services

- do not install gnome or other gui

- install iptables and only allows tcp/udp 53

- for administration, use only ssh and only permit specific source ip addresses

- bind can be configure with acl and only allows recursive query for specific network

- do not allow remote access to root account even in ssh. user need to "su -" to root after successful login

Restrict the soa/master for access.

- You can hide it behind a fw and using private ip with no outside network access to it.

- Only allow internet access to slaves

- When registering NS to Domain Authority and NIC (for reverse zone), only register slaves.

- The only connection to/from soa/master is the zone transfer from soa/master to slaves

Remember to configure all NS to download the zone from the root monthly. This can be done by creating a script and run in cron

You can scan it using nessus every 2 months to check for vulnerability.


This Discussion